US 7120682 B1
A method for providing virtual private networks for voice over data network users. A location server is provided that has more than one routing information database. A virtual private network is defined within that location server for each of the routing information databases. As registration information from gateways is received, they are associated with the appropriate virtual private network.
1. A method for providing virtual private networks for voice over data network applications, the method comprising:
creating at least two routing information databases on a location server;
defining a voice virtual private network having a virtual private network identification such that each virtual private network corresponds to one of the routing information databases, wherein each routing information database maintains information for the virtual private network having a given virtual private network identification;
receiving registration information from at least two gateways in communication with the location server, wherein the registration information allows identification of a virtual private network; and
associating each gateway with one of the voice virtual private networks by associating each gateway with a virtual private network identification.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. A network device, comprising:
more than one routing information database wherein each routing information database is associated with a different virtual private network, the virtual private network identifiable by a virtual private network identification;
at least one port operable to receive registration information from gateways in communication with the network device; and
an association table operable to associate each routing information base with a different virtual private network and each gateway with a different routing information base.
8. The network device of
9. The network device of
10. The network device of
11. An article comprising a processor having instructions stored in memory that, when executed, result in:
creation of at least two routing information databases on a network device;
association of a different voice virtual private network with each routing information database such that each routing information database is associated with a different virtual private network by a virtual private network identification;
reception of registration information from gateways in communication with the location server; and
association of each gateway with one of the virtual private networks.
12. The article of
13. A network device, comprising:
means for providing more than one routing information base;
means for defining a voice virtual private network such that each virtual private network corresponds to one of the routing information databases, wherein each routing information database is associated with a different virtual private network, the virtual private network identifiable by a virtual private network identification;
means for receiving registration information from gateways in communication with the network device; and
means for associating each gateway with one of the voice virtual private networks.
This disclosure relates to voice applications over data networks, more particularly to providing virtual private network services for voice applications over data networks.
Data networks have given rise to many alternatives to traditional phone service. Enterprises of all kinds can use the capacity of their intra-enterprise data network to route packets of all kinds of data, such as voice and video. Voice over data networks have rapidly developed. The data network may follow one of many standardized protocols for establishing connections between nodes on the network to pass packets between end users. These include Internet Protocol (IP), Frame Relay (FR), Asynchronous Transfer Mode (ATM), among others. Voice over these networks is referred to typically as Voice-over-IP, Voice-over-FR, or Voice-over-ATM. Generally, these will all be referred to as Voice-over-X, or VoX. One of the features offered in the telephone realm is that of a virtual private network (VPN). In regard to telephones, a VPN allows a private network to be set up and administered over public wires in the public switched telephone network (PSTN). Recently, some network providers have begun offering VPNs for data networks. Using a VPN from a network provider allows the enterprise to have a secure, authorized-user only data network without having to buy, administer and maintain all of the equipment necessary for a truly private network. The enterprise need only have servers that allow their users to connect to the network provider servers.
However, the VoX area is one in which VPNs are not currently being offered. Generally, these VoX networks require interfaces to the PSTN, as well as specialized equipment to enable VoX calls. Many end users that may be recipients of a VoX call will use standard telephones, hence the requirement that the VoX network interface with PSTN equipment. Currently, no solution to the problem of offering virtual private network services for voice applications over data networks has been identified.
One aspect of the disclosure is a method for providing virtual private networks for voice over data network users. A location server is provided that has more than one routing information database. A virtual private network is defined within that location server for each of the routing information databases. As registration information from gateways is received, they are associated with the appropriate virtual private network. An identifier is assigned to each virtual private network and passed between location servers to ensure the correct routing information for each virtual private network is synchronized between the location servers.
The invention may be best understood by reading the disclosure with reference to the drawings, wherein:
An NTAD such as 10 of
Each location server exchanges information with other location servers so that they remain synchronized. This can be accomplished in several ways. During the initialization of a peer-to-peer connection between two location servers, they may do a complete exchange of their databases, ensuring that both of them have the same information. As new gateways are linked to any given location server, or any information comes to one location server that affects the peer server, that information may be sent as an incremental update. The term ‘gateway’ as used here is slightly different than that used in most contexts. A gateway, as used here, is any component at a customer site that communicates with the network service provider location server that provides the VPN service. This will be discussed in more detail further.
Currently, most protocols and standards track the new members of the NTAD and the routing information in routing information databases. One such protocol is the Telephony Routing over Internet Protocol (TRIP), set out by the Internet Engineering Task Force. Another is the Border Gateway Protocol used to distribute routing information between administrative domains. However, TRIP is specific to IP telephony and BGP is directed to routing information on data networks in general.
TRIP does not have the capability to provide virtual private networks for voice over data networks. The routing information databases in TRIP are referred to as routing information bases (RIBs). TRIP only considers a single RIB per location server. The RIB includes all routes learned from the other peers. There is no way to implement a virtual private network in this type of situation. There is no way for a location server to associate different external peers with different virtual private networks and to maintain separate RIBs for each VPN. This can be seen from the following example.
If a network service provider provided TRIP services to several different enterprises, there is no way to isolate one enterprise from another. Routes from different enterprises will be inserted into the same RIB. All of the location servers would have the same RIB, so all of the location servers would manage one large network, instead of several private networks, one for each enterprise. In order for each enterprise to have its own network, it would either have to maintain a proprietary network internally, or ask the network provider to configure a separate network with separate equipment. For apparent reasons, this is impractical for the network provider, so the enterprise must bring their private network internal.
However, if several segregated routing information databases could be maintained, several virtual private networks can be maintained within one NTAD. Each routing information database can be associated with a different virtual private network. The location servers can be configured to insert all routes received from a specific external peer to a specific routing information database. For the example of TRIP above, there would be several RIBs on each location server.
In order for the location server to maintain several routing information databases, however, some way to differentiate the information destined for each database would have to be provided. One method to allow differentiation would assign a VPN identification (VPNID). The VPNID would allow the location server to identify into which routing information database the information is to go.
The external peers are those resources that are outside the administrative domain, but have information required by the NTAD. Examples of these could be servers in other NTADs, or gateways located at or administrated by the enterprise. In
As discussed above, these gateways communicate with the service provider location servers. They could be SIP (session initiation protocol) proxy servers connecting IP phones, a H.323 (the standards governing audiovisual conferencing over IP) gatekeeper managing IP phones, a PBX (private branch exchange) with data network interface managing traditional phones, or even a IP/PSTN gateway connecting the traditional phones at a customer site, as examples. Generally, the gateway advertises the reachability of destinations in the customer site to the service provider location server and queries the service provider location server for routing information outside the customer's local site. These functions could be contained in one piece of hardware or may reside in two different physical elements.
As can be seen in
When the gateways initially join the NTAD, they transfer their reachability and other necessary information to the location server, including the VPN. When a customer gateway receives a call, it queries the location server as to the best route. The location server then determines the appropriate VPN based upon the VPNID assigned by the system to that gateway and looks at routes in the associated routing information database. The gateways themselves do not have to be aware of the VPNIDs, they are assigned by the location server from the NTAD.
In addition to offering the features associated with a private network to the customer, the network provider could also provide the customer the ability to call outside the VPN. One method for accomplishing this may include using a global routing information database and leaking information from the global routing information database into the routing information database of that customer.
The location server holds all of this information, segregated into VPNs. The global routing information database is updated every time an update is sent. Each individual routing information database is updated only when updates are received for the particular VPNID. An example of a location server is shown in
The location server 14 from
When the gateway 114 becomes active on the port 24, the appropriate routing information database is accessed when identified from the association table. This ensures that the gateway 114, a member of VPN 1, receives the routing information for VPN 1. The location server also has an interface 26 for communication with the other location servers. This is shown as being on the same port 24, for simplicity only. There may be a second port through which the location server 14 communicates with the other location servers, such as 12, shown, and 16, shown in
The location servers will update each other as new gateways become active. For example, if a call is initiated through gateway 114 the location server 14 assigns the VPNID. This is then sent to the other location servers to let them know to what VPN the route being advertised belongs. This ensures the proper routing information database in each location server is used to route calls for that gateway. In this manner, enterprises can access a secure network without having to maintain and administrate the network itself.
One embodiment of a process for providing virtual private networks for voice over network applications is shown in
Other processes are possible for setting up and initializing a virtual private network for voice over networks applications. The above is just intended as an example. Any process that results in several routing information databases, each associated with a VPN, being resident on a network device will achieve the desired result.
Typically, the configuration of location servers and establishing of databases and tables to define VPNs would be accomplished through software upgrades on network devices. The software upgrade would be distributed as an article containing software instructions, such as in a downloadable file. Once the file is downloaded into the network device, a series of instructions included on the downloadable file perform the methods of the invention. Other types of articles could include the instructions, such as processor in a new network device that has the instructions stored in memory.
Thus, although there has been described to this point a particular embodiment for a method and apparatus for providing virtual private networks for voice over networks applications, it is not intended that such specific references be considered as limitations upon the scope of this invention except in-so-far as set forth in the following claims.